Author
Topic: WMA Wimad[Drp] (Read 24825 times)

I have discovered that many of my mp3 and wmv files come up as having been infected with the above trojan. When I scan the files with Spybot, the trojan is identified in heuristic mode as Fraud.Installer .as. The curious thing is that everything I have read about this malware says that it creates fake mp3 files which then say they require additional software to play them. This hasn't been the case with me. The files that are infected are legitimate mp3 files, and they have all been created on this computer. They play normally. While I did download some codecs in the past, none of them showed up as being infected.

The problem I have is that the infection is so widespread (literally hundreds of files) that if I were to delete them all, it would take weeks, if not months, to restore them again.

Presumably because the files play normally, it is only the header that has been infected. Is there any way the files can be repaired?

If we report them as WMA:Wimad, they're not MP3's anymore, they're Windows Media Audio files and they were auto-converted. They're not in the original state and quality - the only thing what to do with them is to delete and recreate.

Thank you for your response, although it is a very depressing one. :'( Many of the files affected are irreplaceable.

The only other thing I can ask you is this: assuming the trojan concerned is not apparently doing anything to my system (it hasn't asked me to download anything), would there be any harm in allowing the files to remain on my computer, so long as I didn't send them to anybody else? I ask, because although you said the quality would be affected, there is no obvious difference that I can hear. Many of the files are classical, and are just as acceptable as the original mp3s.

So in their present state, are the files causing any active harm? Could they remain on my system?

Ok, a couple of things. Firstly, was your solution designed to remove the infection, or just to make the files playable? I ask, because in fact they *are* already playable. They play normally, with no noticeable loss of quality. That is why I asked whether the infection is actually doing any harm in its current form, because if not I could leave the files alone, and just make sure I don't send them to anybody. If it did remove the infection, then it would certainly be worth pursuing, as I really don't want to lose some of these files.

(Incidentally, I tried to treat these as wma files and used a converter to change them back to mp3. When I did this the conversion worked, but the resultant files were very choppy and unusable.)

Secondly, I went through your procedure, and extracted the section from the registry. The only problem was that when I searched for my old user name, it is not there. I did find the new one, in one entry, but that was all

Yes it would remove the infection, because that is going on actually online. If you deleted the previous malicious string, you have lost it. Make a note of all I mentioned there and perform everything meticulously step by step. I gave the solution as I found it, but it is well worth a try, else you will start it over again opening up your media player. After you have cleared this completely, switch for VLC Media Player to be downloaded from here: http://www.videolan.org/mirror-geo.php?file=vlc/0.9.8a/win32/vlc-0.9.8a-win32.exe

polonus

Logged

Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Ok - I am not sure what that was supposed to do. The situation is now as follows:-

Before - The files all gave rise to warning messages when they were scanned by Avast. However, they played ok on Windows Media Player.

After - The files still give rise to warning messages. When played by Windows Media Player they first of all tell me that they are not mp3 files (which I had been warned about in an earlier posting). If I tell media player to play them anyway they stop after a few seconds, and Avast comes up with an error message. It appears that I am being directed to a site which no longer exists:- www.isvbr.net. They play ok on the VLC player, although the quality seems to have deteriorated.

I am not sure how those instructions were supposed to help the problem I outlined in my previous postings. But thanks anyway for the help.

My problem is that I have a large number of music and video files which, when scanned with Avast, tell me they contain a trojan. As many of these files were created by me or bought from sites I cannot now locate, many of them cannot be replaced. I was hoping there was some way to access these files so as to remove the trojan, but to leave the files intact, but it appears that this is not the case. :'(

PS: Ah, I see the assumption was that the malware was residing in WMP, and infected every file that it played. Yes, that makes sense, although I am not sure that it remained in the media player, because later files have not been affected, although they have been played.

You are welcome, I am happy when you are happy, and that is why we have put all the effort together in finding a solution.That is why we malware fighters all do this.Great it worked for you, enjoy your valuable files, and be safe and secure,

polonus

Logged

Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Believe it or not, I have one. In this case the trojan wasn't detected until I did a thorough scan, and by then it had infected both my backup disks. I suppose the only lesson I can draw from this is to do thorough scans more often.

Interestingly, if I'd been running my previous virus checker, for which I had been paying for the last five years (I changed to Avast because I could no longer afford the other one) I would still be blissfully unaware of the trojan, which would be happily infecting my new drive.